Description
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TOTOLINK | T10 | 4.1.8cu.5207 | — |
References
- VDB-312606 | TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow vdb-entry technical-description
- VDB-312606 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #592911 | TOTOLINK T10 V2_Firmware V2_V4.1.8cu.5207 Buffer Overflow third-party-advisory
- https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiScheduleCfg-20ddf0aa11858053a171f052787c202f exploit
- https://www.totolink.net/ product